Bug 1266928
| Summary: | iscsid related rule is missing | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Fabian Deutsch <fdeutsch> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | urgent | ||||||
| Version: | 7.2 | CC: | bmcclain, fhubik, lmiksik, lvrabec, mgrepl, mmalik, nfd, plautrba, pvrabec, ssekidde | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-3.13.1-56.el7 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2015-11-19 10:46:45 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1172230 | ||||||
| Attachments: |
|
||||||
Created attachment 1077945 [details]
audit.log with avc denials
This is cause by #916635 which we need to revert and remove from the errata. (In reply to Miroslav Grepl from comment #5) > This is cause by #916635 which we need to revert and remove from the errata. What does #916635 refer to? I cannot access this bug to see the cause. The present bug seems related to https://bugzilla.redhat.com/show_bug.cgi?id=1258194 "SELinux is preventing iscsid from 'read' accesses on the file /usr/lib/modules/4.1.6-200.fc22.x86_64/modules.dep.bin" We changed labeling for /lib/modules/*/modules.dep* to modules_dep_t but the problem is they are still placed with modules_object_t in some cases. So we should revert the change back to have modules_object_t as a default label. Another possible fix would be define all filenametrans rules correctly to get the correct labeling. *** Bug 1267638 has been marked as a duplicate of this bug. *** Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2300.html |
Description of problem: When using iscsid (iscsi-initiator-utils) on some pre-RHEL 7.2 with selinux-policy-3.13.1-53.el7 I'm getting a denial which needs the following rule to be solved: allow iscsid_t modules_dep_t:file { read open getattr }; Version-Release number of selected component (if applicable): selinux-policy-3.13.1-53.el7 How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info: We see this on pre-RHEV 3.6 based on pre-RHEL 7.2 We did not see this denial before